PRIVACY POLICY

1. INTRODUCTION

Mulberry Insurance Brokers PCC Limited (company registration number C 73395), a company registered in Malta with its registered office at A3 Towers, Tower A3, Level 13, Triq il-Kanonku Karm M. Bologna, Paola PLA 1560, Malta (“Mulberry”, “we”, “our” or “us”), is committed to protecting your privacy and to processing your personal data in a lawful, fair and transparent manner. Mulberry is enrolled in the Brokers List under the Insurance Distribution Act (Cap. 487 of the Laws of Malta) to carry out insurance distribution activities and is regulated by the Malta Financial Services Authority. For the purposes of Regulation (EU) 2016/679 (the “GDPR”) and the Data Protection Act (Cap. 586 of the Laws of Malta), Mulberry is the controller of the personal data described in this Privacy Policy. This Privacy Policy explains how we collect, use, disclose and protect personal data obtained through our website at mulberrybrokers.com and through the enquiry, quotation, contact and subscription functionality made available on it. Personal data processed in connection with the arranging, placing and administration of insurance and the handling of claims is dealt with in our Data Protection Notice, and our relationship with clients is governed by our Client Terms of Business Agreement.

2. INFORMATION WE COLLECT

When you visit our website, contact us through online forms, request information, or use our services, we may collect personal information including:

• Name and surname;
• Address;
• Telephone number;
• Email address;
• Information submitted through contact or enquiry forms;
• Employer, occupation or business details where relevant to your enquiry;
• Curriculum vitae and related information, where you apply for a vacancy;
• Any other information voluntarily provided by you.

Our contact and enquiry forms are not intended for special categories of personal data (such as data concerning health) or for information about criminal convictions or offences, and you should not submit such information through them. Where information of that kind is necessary for example for health, life or travel cover, or in connection with a claim we will collect it through an appropriate channel and on the basis explained in our Data Protection Notice. In addition, technical information may be collected automatically, including:

• Internet Protocol (IP) address;
• Browser type and version;
• Device information;
• Operating system;
• Website usage and navigation data.
• Approximate location derived from your IP address;
• Referring website and pages viewed, including time spent and interaction data;
• Cookie and similar identifiers.

This information assists us in maintaining website security, improving functionality and enhancing the user experience. Technical information which is not strictly necessary for the operation of the website is collected only where you have consented in accordance with section 9.

3. PURPOSES AND LEGAL BASIS OF PROCESSING

We process personal data for the following purposes and on the following legal bases under Article 6 of the GDPR:

• Responding to enquiries, requests for information and callback requests, being steps taken at your request prior to entering into a contract, or, our legitimate interest in responding to those who contact us;
• Providing quotations and arranging insurance cover where we are complying with obligations under the Insurance Distribution Act (Cap. 487) and applicable MFSA rules;
• Administering customer relationships where the individual concerned is not the contracting party;
• Complying with legal and regulatory obligations, including customer due diligence, sanctions screening, record-keeping and regulatory reporting;
• Measuring and analysing use of the website in order to improve it, your consent, given through our cookie preference centre;
• Preventing, detecting and investigating fraud and other unlawful activities, the legitimate interests of Mulberry and of the insurance market in combating fraud;
• Sending marketing communications, with your specific consent, or, where you are an existing customer, together with the “soft opt-in” permitted by the Processing of Personal Data (Electronic Communications Sector) Regulations (S.L. 586.01);
• Maintaining the security, integrity and availability of the website and preventing misuse, protecting our systems, our users and our business; and
• Establishing, exercising or defending legal claims and responding to complaints, protecting our legal position.

Where we rely on legitimate interests, we have assessed those interests against your interests, rights and freedoms; you may request information about that assessment and you may object to the processing as described in section 5. Where we rely on consent, you may withdraw it at any time, and we will make withdrawal as easy as giving consent.

4. MARKETING COMMUNICATIONS

Where you have consented to receive marketing communications, we may provide information relating to:

• New products and services;
• Promotional campaigns;
• Company news and updates;
• Industry developments that may be relevant to you.

Where you are an existing customer and we obtained your electronic contact details in the course of providing a product or service to you, we may send you marketing about our own similar products and services. You will be given a free and simple means of objecting both at the point of collection and in every communication we send. Every electronic marketing communication contains an unsubscribe facility. You may also withdraw your consent or object at any time by contacting us at info@mulberrybrokers.com. We do not sell personal data and we do not disclose it to third parties for their own marketing purposes.

5. YOUR RIGHTS, WITHDRAWAL OF CONSENT AND REQUESTS

Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal. Subject to the conditions and exceptions in the GDPR, you have the right to:

• obtain confirmation as to whether we process personal data about you and, if so, to receive a copy of it together with information about the processing;
• have inaccurate personal data corrected and incomplete personal data completed;
• have personal data erased, to have processing restricted, and to receive personal data you provided to us in a portable format;
• object to processing based on legitimate interests, including an unqualified right to object to direct marketing; and to withdraw consent where processing is based on consent (Article 7(3)),

may be made by contacting: michelle@mulberrybrokers.com We will respond within not later than one month of receipt. That period may be extended by up to two further months where a request is complex or where we have received a number of requests, in which case we will tell you within the first month and explain why. No fee is payable unless a request is manifestly unfounded or excessive, and we may ask you for information to confirm your identity. These rights are not absolute. In particular, we may be unable to erase personal data, or to give effect to an objection, where we are required to retain it under the Insurance Distribution Act (Cap. 487) or under anti-money laundering legislation, or where it is needed for the establishment, exercise or defence of legal claims. Where we decline a request we will explain why and tell you how to complain.

6. DISCLOSURE OF INFORMATION

We may disclose personal information where:

• disclosure is required by law, regulation or court order;
• disclosure is necessary for the establishment, exercise or defence of legal claims;
• disclosure is necessary to protect our rights, property or interests;
• you have authorised such disclosure; or
• disclosure is required for the provision of insurance products and services.

We may also disclose personal data to our professional advisers, to competent authorities including the Malta Financial Services Authority, the Financial Intelligence Analysis Unit, the Information and Data Protection Commissioner, the courts and the police where we are required or permitted to do so, and to a purchaser or prospective purchaser in connection with a sale or transfer of all or part of our business.

7. THIRD-PARTY WEBSITES AND SERVICE PROVIDERS

We may engage carefully selected third-party service providers who process personal data on our behalf and only to the extent necessary for the provision of services. Such providers include our website developers, hosting and information technology providers and our email, customer relationship management and marketing platform providers. Each of them acts only on our documented instructions and under a written contract meeting the requirements of Article 28 of the GDPR. Where our website contains links to external websites, please note that such websites operate independently of Mulberry. We are not responsible for their privacy practices and encourage users to review the privacy notices of any third-party websites before providing personal information.

8. DATA SECURITY

We implement appropriate technical and organisational measures designed to safeguard personal information from:

• accidental loss;
• unauthorised access;
• misuse;
• alteration;
• disclosure; and
• destruction.

While no electronic transmission or storage system can guarantee absolute security, we endeavour to apply industry-standard safeguards to protect personal data. The measures we apply include encryption of data in transit, access controls and authentication, logging and monitoring, patching and vulnerability management, staff training and confidentiality undertakings, secure back-ups and supplier due diligence. We maintain a personal data breach procedure. Where a breach occurs, we will notify the Information and Data Protection Commissioner and, where required, affected individuals, in accordance with Articles 33 and 34 of the GDPR.

9. COOKIES

Our website uses cookies and similar technologies to improve performance, functionality and user experience. Cookies fall into the following categories: Essential Cookies Required for the secure operation and functionality of the website. These are placed without consent because the website cannot function properly without them. Functional Cookies Used to remember choices you make, such as language or region, in order to provide enhanced features. Analytical Cookies Used to measure and analyse website traffic and user interactions to improve website performance. Advertising and Targeting Cookies Used to deliver relevant advertising, measure marketing effectiveness and limit repetitive advertisements. With the sole exception of strictly necessary cookies, no cookie or similar technology is placed on or read from your device unless and until you have given your consent through our cookie preference centre. Consent is obtained by a clear affirmative act: we do not use pre-ticked boxes, we do not treat continued browsing or scrolling as consent, and the option to reject is presented as prominently as the option to accept. You may change or withdraw your cookie preferences at any time through the cookie preference centre, a link to which appears on every page of the website. Withdrawal is as straightforward as giving consent. Your browser settings provide an additional control but are not our primary mechanism. A full and current list of the cookies we use, giving for each cookie its name, provider, purpose, type and duration, is available on our Cookie Policy page. Where a third-party analytics or advertising provider determines the purposes and means of its own processing, that provider acts as a controller in its own right and its own privacy notice applies. Please note that disabling certain cookies may affect website functionality.

10. RETENTION OF PERSONAL DATA

We retain personal data only for as long as is necessary for the purposes for which it was collected and to comply with our legal, regulatory and contractual obligations. Enquiries which do not result in a client relationship are retained for 6 months from our last contact with you. Server and security logs are retained for to the nature and criticality of the ICT system, the outcome of the ICT risk assessment, applicable legal or regulatory requirements, or the requirements of an investigation. Cookie data is retained for the periods stated in the cookie list referred to in section 9. Marketing preferences are retained for as long as is necessary to ensure that we do not contact you again. Personal data processed in connection with insurance services is retained for the periods set out in our Data Protection Notice. Where a complaint, claim, investigation or legal proceedings is pending, we retain the relevant records until the matter is concluded and the applicable prescriptive period has elapsed. At the end of the applicable period personal data is securely deleted or irreversibly anonymised.

11. AUTOMATED DECISION-MAKING AND PROFILING

We do not take decisions producing legal effects concerning you, or similarly significantly affecting you, based solely on automated processing of personal data collected through this website. Where any automated processing of that kind is introduced, we will inform you, explain the logic involved and the significance and envisaged consequences of the processing for you, and you will have the right to obtain human intervention, to express your point of view and to contest the decision.

12. MINORS

This website is directed at adults and is not intended for children, and our services are directed at persons who have the legal capacity to enter into a contract of insurance. Where an information society service is offered directly to a child and the processing is based on consent, Malta has exercised the discretion under Article 8(1) of the GDPR and set the relevant age at thirteen (13) years by virtue of the Processing of Child’s Personal Data in relation to the Offer of Information Society Services Regulations (S.L. 586.11). Below that age, the processing is lawful only if and to the extent that consent is given or authorised by the holder of parental responsibility over the child. Where applicable, parents or legal guardians must supervise the use of the website by minors and provide any required consent. If you believe that a child has provided us with personal data, please contact us and we will take steps to delete it.

13. CHANGES TO THIS PRIVACY POLICY

We may amend this Privacy Policy periodically to reflect legal, regulatory, operational or technical developments. Any amendments will become effective upon publication on our website. Where material changes are made, we will take reasonable steps to notify users as appropriate. We will not use personal data already collected for a materially different purpose without a lawful basis for doing so and, where consent is required, without obtaining it.

14. INTERNATIONAL TRANSFERS OF PERSONAL DATA

In providing our services, personal data may be transferred to recipients located outside the European Economic Area (“EEA”). Where such transfers occur, Mulberry will ensure that appropriate safeguards are implemented in accordance with applicable data protection legislation. Such safeguards may include:

• transfers to a country in respect of which the European Commission has adopted an adequacy decision under Article 45 of the GDPR;
• the Standard Contractual Clauses adopted by the European Commission under Article 46(2)(c) of the GDPR, supplemented, where a transfer impact assessment shows this to be necessary, by additional technical, contractual or organisational measures; or
• binding corporate rules approved under Article 47 of the GDPR, or a derogation under Article 49 of the GDPR where one applies.

You may obtain further information about the safeguards applied, and a copy of the relevant documentation, by contacting us at the address given at the end of this Privacy Policy.

15. COMPLAINTS

If you are concerned about the way we have handled your personal data, please contact us first so that we can investigate. You also have the right to lodge a complaint with the Information and Data Protection Commissioner, Level 2, Airways House, Triq il-Kbira (High Street), Sliema SLM 1549, Malta; telephone +356 2328 7100; idpc.org.mt. Complaints concerning our insurance services, as distinct from the handling of your personal data, are dealt with under our complaints procedure and may, if not resolved to your satisfaction, be referred to the Office of the Arbiter for Financial Services.

16. CONTACT DETAILS

Should you require further information regarding this Privacy Policy or the processing of your personal data, please contact: The Data Protection Officer Mulberry Insurance Brokers PCC Ltd A3 Towers, Tower A3, Level 13, Triq il-Kanonku Karm M. Bologna, Paola PLA 1560, Malta michelle@mulberrybrokers.com | +356 2099 7391